Privacy Policy

At Voice XO, your privacy and security are our top priorities. We are committed to protecting your personal information and being transparent about how we collect, use, and safeguard your data. This Privacy Policy explains your rights under the General Data Protection Regulation (GDPR) and other applicable privacy laws.

Voice XO is a voice-first dating platform that uses voice profiles and biometric voice data to create authentic connections. We take the protection of this sensitive data seriously and implement industry-leading security measures.

Before You Sign Up (Visitors)

• Website Usage Data: Pages visited, time spent, device type, browser information
• Cookies: Essential cookies for site functionality, analytics cookies (with your consent)
• IP Address: For security and geolocation purposes

After You Sign Up (Users)

• Account Information: Email address, password (encrypted), display name, date of birth
• Profile Data: Gender, location, relationship preferences, interests, biography
• Voice Biometric Data: Voice recordings (profile voice, voice introductions, voice messages)
• Photos & Media: Profile pictures, shared images in conversations
• Matching Preferences: Religion, sexuality, relationship type, pets, languages, lifestyle habits
• Interaction Data: Likes, voice introductions sent/received, messages, blocks, reports
• Device & Location Data: GPS location (with permission), device ID, push notification tokens

We process your personal data under the following lawful bases (GDPR Article 6):

• Contractual Necessity: To provide the Voice XO service, create your account, and enable matching
• Legitimate Interests: To improve the app, detect fraud, ensure safety, and conduct analytics
• Legal Obligation: To comply with applicable laws, prevent abuse, and respond to legal requests
• Explicit Consent: For voice biometric data processing, marketing communications, and non-essential cookies

Voice recordings are classified as biometric data under GDPR Article 9 and receive the highest level of protection:

• End-to-End Encryption: Voice files are encrypted during transmission (SSL/TLS) and at rest (AES-256)
• Access Controls: Only you and users you've accepted can access your voice introductions
• Secure Storage: Voice data is stored on Supabase's EU-compliant servers with redundancy and backups
• Deepfake Protection: We employ voice analysis to detect AI-generated or manipulated audio
• No Third-Party Sharing: Your voice recordings are never shared with advertisers or data brokers
• Automatic Deletion: Voice data is automatically deleted 12 months after account deletion

Your Explicit Consent: By recording a voice profile or voice introduction, you provide explicit consent for Voice XO to process your voice biometric data for matching and authentication purposes. You can withdraw this consent at any time by deleting your voice recordings or account.

Under the GDPR, you have the following rights regarding your personal data:

How to Exercise Your Rights: Contact us at support@voice-xo.com with the subject line "Data Rights Request." We will respond within 30 days as required by GDPR.

We use cookies to enhance your experience and analyze site usage. See our Cookie Policy for full details.

• Essential Cookies: Required for login, security, and basic functionality (always active)
• Analytics Cookies: Google Analytics for usage insights (opt-in via cookie banner)
• Marketing Cookies: Ad tracking and retargeting (opt-in via cookie banner)

Manage your cookie preferences anytime via the cookie banner or settings.

We retain your data only as long as necessary for the purposes outlined in this policy:

• Voice Recordings: 12 months after account deletion
• Profile Data: 24 months after account deletion (for fraud prevention)
• Chat Messages: 6 months after deletion from your account
• Analytics Data: 24 months, anonymized after 6 months
• Cookie Consent Records: 12-24 months depending on cookie category
• Legal Records: As required by law (e.g., financial records for tax purposes)

Voice XO operates globally, and your data may be transferred to and stored in countries outside the European Economic Area (EEA), including the United States. We ensure adequate safeguards through:

• Standard Contractual Clauses (SCCs): Approved by the European Commission for data transfers
• Supabase Compliance: Our infrastructure provider is SOC 2 Type II certified and GDPR-compliant
• Encryption: All data transfers use SSL/TLS encryption

We use the following third-party services, each with their own privacy policies:

• Supabase: Database and authentication (GDPR-compliant, EU servers available)
• Google Analytics: Website analytics (anonymized IP, opt-in required)
• Stripe: Payment processing (PCI DSS compliant, if premium features are added)
• Push Notification Services: Firebase Cloud Messaging (opt-in for push notifications)

We never sell your data to third parties. Third-party access is strictly limited to providing services.

We implement industry-standard security practices to protect your data:

• SSL/TLS encryption for all data in transit
• AES-256 encryption for voice files at rest
• Regular security audits and penetration testing
• Multi-factor authentication (MFA) available for accounts
• Row-level security (RLS) policies on database tables
• Automated backup and disaster recovery systems

Voice XO is strictly for users 18 years of age or older. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will immediately delete it and all associated data. If you believe a minor is using Voice XO, please report it to support@voice-xo.com.

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make significant changes, we will notify you via email or in-app notification and request re-consent where required by law. The "Effective Date" at the top indicates the latest update.

For privacy questions, data rights requests, or concerns about how we handle your information:

• Email: support@voice-xo.com
• Subject Line: "Privacy Request" or "Data Rights Request"
• Response Time: Within 30 days (GDPR requirement)

Supervisory Authority: If you are located in the EU/EEA, you have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

Voice Recordings & Consent: By using Voice XO's voice features, you acknowledge and consent to:

• Recording and storing your voice for profile and introduction purposes
• Voice recordings being played to other users you choose to connect with
• Voice biometric analysis for authentication and deepfake detection
• One-party consent for voice introductions (you consent by sending the message)

No AI-Generated Voices: Our Terms of Service prohibit the use of AI-generated or deepfake voices. We employ detection technology to identify and remove fake voice profiles.

Jurisdiction-Specific Laws: Some jurisdictions (e.g., Illinois BIPA, California CCPA) have specific voice biometric laws. If you reside in such areas, additional rights may apply. Contact us for more information.

Payments for Voice XO Premium subscriptions and Credit Packs are processed by Stripe Payments Europe, Ltd. When you purchase, Stripe collects your billing name, address, payment-method details, IP address, and tax-residency information directly. Voice XO never sees or stores your card number.

The lawful basis for this processing is performance of a contract with you (Art. 6(1)(b) GDPR) and compliance with our legal tax and accounting obligations (Art. 6(1)(c) GDPR). Stripe acts as an independent controller for the payment activity it performs; its handling of your data is governed by Stripe's own privacy policy at stripe.com/privacy.

We retain a minimal record of each transaction — customer id, subscription status, renewal date, and internal credit-ledger entries — for as long as your account exists and, thereafter, for the period required by applicable tax law (typically 7 years in the EU). Card numbers and CVCs are never retained.

When you delete your Voice XO account, any active Stripe subscription is cancelled automatically before your data is purged, so you will not continue to be billed for a deleted account.